diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 2c0c502..ec70c1c 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,13 @@
+2022-01-14  Mark Lam  <mark.lam@apple.com>
+
+        JSStringJoiner's constructor should take a size_t length.
+        https://bugs.webkit.org/show_bug.cgi?id=235217
+        rdar://87538657
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/max-typed-array-length-toString.js: Added.
+
 2022-01-14  Alexey Shvayka  <ashvayka@apple.com>
 
         JSArray::fastSlice() should not convert the source from CoW
diff --git a/JSTests/stress/max-typed-array-length-toString.js b/JSTests/stress/max-typed-array-length-toString.js
new file mode 100644
index 0000000..0b15e6f
--- /dev/null
+++ b/JSTests/stress/max-typed-array-length-toString.js
@@ -0,0 +1,14 @@
+//@ skip if $architecture != "arm64" && $architecture != "x86-64"
+
+var exception;
+try {
+    var memory = new WebAssembly.Memory({
+        initial: 65536
+    });
+    new Uint8Array(memory.buffer).toString();
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "RangeError: Out of memory")
+    throw "FAILED: " + exception;
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index d1e7f26..6f96d4e 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,18 @@
+2022-01-14  Mark Lam  <mark.lam@apple.com>
+
+        JSStringJoiner's constructor should take a size_t length.
+        https://bugs.webkit.org/show_bug.cgi?id=235217
+        rdar://87538657
+
+        Reviewed by Yusuke Suzuki.
+
+        Also removed an unnecessary exception check in JSStringJoiner::append().
+        This is because appendWithoutSideEffects() cannot throw any exceptions.
+
+        * runtime/JSStringJoiner.h:
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+
 2022-01-14  Alexey Shvayka  <ashvayka@apple.com>
 
         JSArray::fastSlice() should not convert the source from CoW
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.h b/Source/JavaScriptCore/runtime/JSStringJoiner.h
index 74e8892..6a72692 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.h
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2022 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,8 +33,8 @@
 
 class JSStringJoiner {
 public:
-    JSStringJoiner(JSGlobalObject*, LChar separator, unsigned stringCount);
-    JSStringJoiner(JSGlobalObject*, StringView separator, unsigned stringCount);
+    JSStringJoiner(JSGlobalObject*, LChar separator, size_t stringCount);
+    JSStringJoiner(JSGlobalObject*, StringView separator, size_t stringCount);
     ~JSStringJoiner();
 
     void append(JSGlobalObject*, JSValue);
@@ -57,7 +57,7 @@
     bool m_isAll8Bit { true };
 };
 
-inline JSStringJoiner::JSStringJoiner(JSGlobalObject* globalObject, StringView separator, unsigned stringCount)
+inline JSStringJoiner::JSStringJoiner(JSGlobalObject* globalObject, StringView separator, size_t stringCount)
     : m_separator(separator)
     , m_isAll8Bit(m_separator.is8Bit())
 {
@@ -67,7 +67,7 @@
         throwOutOfMemoryError(globalObject, scope);
 }
 
-inline JSStringJoiner::JSStringJoiner(JSGlobalObject* globalObject, LChar separator, unsigned stringCount)
+inline JSStringJoiner::JSStringJoiner(JSGlobalObject* globalObject, LChar separator, size_t stringCount)
     : m_singleCharacterSeparator(separator)
     , m_separator { &m_singleCharacterSeparator, 1 }
 {
@@ -152,7 +152,6 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     bool success = appendWithoutSideEffects(globalObject, value);
-    RETURN_IF_EXCEPTION(scope, void());
     if (!success) {
         JSString* jsString = value.toString(globalObject);
         RETURN_IF_EXCEPTION(scope, void());